f7664ddbb96dd75b1e6df5564719a7c544462e5623d80754eedf5af404c3c8af

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:57

Target

2ae1f3a35e25161bbc3f2e86b7301c65.dll
Size

445KB
MD5

2ae1f3a35e25161bbc3f2e86b7301c65
SHA1

3e5bd8b5344e57a781e57ef133ef7145f1f198c1
SHA256

f7664ddbb96dd75b1e6df5564719a7c544462e5623d80754eedf5af404c3c8af
SHA512

634c40ad25c58978426fd2fe31bdf176128194e416178eaa62914edd0d976912e99233dd7e8c1eb81387b1060242d2c0ddb2013ba11a4b7e11c16ef22e1dfc5c
SSDEEP

12288:7Yh77jDjuFk4LJnqe4qRQhQePCdMgl6kf1TcE+iBqNEf:7Yh77jDjuFkuJnqe4qRQhQePCd9l6kf+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae1f3a35e25161bbc3f2e86b7301c65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae1f3a35e25161bbc3f2e86b7301c65.dll,#1
  2⤵
  PID:2832